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About  Our  New  Look  . . .  This  GAO  report  was  produced  using  a  new  design  and  printing  process 

to  help  you  get  the  information  you  need  more  easily. 

gao  will  phase  in  this  new  design  during  1986.  As  we  do  so,  we  welcome 
any  comments  you  wish  to  share  with  us. 
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United  States 

General  Accounting  Office 

Washington,  D.C.  20548 


Accounting  and  Financial 
Management  Division 

B-219869 


December5,  1985 

The  Honorable  Jack  Brooks 
Chairman,  Legislation  and  National 
Security  Subcommittee 
Committee  on  Government  Operations 
House  of  Representatives 

Dear  Mr.  Chairman: 

In  response  to  your  request  of  July  27, 1984,  this  report  describes  the 
results  of  the  first  phase  of  our  review  of  the  quality  of  audits  per¬ 
formed  by  nonfederal  auditors — mostly  certified  public  accountants 
(CPAs).  The  report  sets  forth  the  details  of  my  testimony  before  you  on 
November  13,  1985,  in  which  I  reported  on  the  problems  federal  inspec¬ 
tors  general  (igs)  have  identified  during  their  reviews  of  audits.  (See 
appendixes  I  and  II.)  I  also  reported  on  the  systems  these  igs  employ  for 
monitoring  audit  quality.  To  complete  our  response  to  your  request,  we 
are  evaluating  a  large  sample  of  CPAs’  audit  work  to  determine  its  com¬ 
pliance  with  professional  standards.  In  this  second  phase  of  our  work, 
we  hope  to  independently  determine  the  extent  of  quality  problems  on 
audits  of  federal  funds  and  identify  the  causes  of  these  problems. 

Our  evaluation  of  the  igs’  audit  quality  review  systems  encompassed  a 
review  of  the  systems  at  46  regional  offices  of  seven  agencies’  inspec¬ 
tors  general.  In  fiscal  year  1984,  these  seven  agencies  administered  pro¬ 
grams  that  accounted  for  95  percent  of  all  domestic  federal  assistance. 
We  also  reviewed  a  statistical  sample  of  328  audit  reports  prepared 
mostly  by  cp as  so  we  could  determine  what  deviations  from  profes¬ 
sional  standards  the  inspectors  general  identified.  In  addition  to  examin¬ 
ing  the  results  of  the  igs’  reviews  of  audit  reports,  we  evaluated  a 
sample  of  223  audits  in  which  the  regional  igs  extended  their  review  to 
the  supporting  working  papers  to  identify  problems  with  general,  field¬ 
work,  and  reporting  standards. 

Our  review  of  the  igs’  quality  control  systems  show  that  they  identify 
significant  numbers  of  problem  reports  and  audits.  Specifically,  we 
found  that: 

•  igs  identified  reporting  problems  needing  correction  in  one  out  of  four 
audit  reports  reviewed.  Generally,  these  problems  related  to  profes¬ 
sional  standards  on  reporting. 
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•  In  our  sample  cases,  igs  identified  and  did  not  accept  about  one  in  five 
audits  in  which  the  required  audit  work  was  not  performed,  or  the  audit 
documentation  was  inadequate  or  unclear,  after  reviewing  the  auditors’ 
working  papers  supporting  the  audit. 

Although  we  found  that  the  igs  worked  with  the  cpas  to  correct  prob¬ 
lems  on  individual  audits,  additional  efforts  are  needed  to  make  use  of 
the  data  in  these  individual  case  files.  In  this  regard,  we  also  noted  that: 

•  igs  have  uneven  policies  and  practices  for  reviewing  the  work  of  cpa 
firms. 

•  igs  rarely  take  action  against  cpas  when  they  identify  unacceptable 
audit  work. 

•  igs  do  not  systematically  compile,  analyze,  and  use  the  results  of  their 
quality  control  reviews  to  correct  recurring  audit  quality  problems. 

This  report  contains  recommendations  to  the  statutory  inspectors  gen¬ 
eral  for  improving  the  audit  quality  review  process.  The  recommenda¬ 
tions  include  calling  for  the  statutory  igs  to  (1)  revise  policies  for  taking 
actions  against  cpas  on  unacceptable  audits,  (2)  work  with  the  aicpa  and 
state  boards  of  accountancy  to  expedite  referrals  to  these  bodies,  and 
(3)  compile,  analyze,  and  use  the  results  of  desk  reviews  and  quality 
control  reviews  to  identify  and  correct  the  underlying  causes  of  audit 
quality  problems.  If  our  recommendations  are  followed,  we  believe  the 
federal  government  will  be  able  to  place  greater  reliance  on  cpa  audits  of 
governmental  entities  to  ensure  that  federal  funds  are  spent  for  autho¬ 
rized  purposes.. 

\ 

We  conducted  out  work  between  October  1984  and  November  1985  in 
accordance  with  generally  accepted  government  auditing  standards.  At 
your  request,  we  did  not  obtain  comments  from  the  inspectors  general 
on  our  conclusions  and  recommendations;  however,  we  verified  the  data 
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obtained  at  each  regional  inspector  general  office.  We  plan  to  release 
this  report  today  and  forward  copies  to  the  inspectors  general  so  that 
they  may  take  action  to  respond  to  our  recommendations. 


Sincerely  yours, 
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Introduction  and 
Background 


The  federal  government  administers  domestic  assistance  programs 
through  state  and  local  governments  with  funds  exceeding  $100  billion 
per  year.  The  Congress,  as  well  as  federal,  state, and  local  officials  and 
private  citizens,  has  a  common  interest  in  assuring  accountability  over 
the  funds  in  those  government  programs.  They  want  and  need  to  know 
if  federal  funds  are  being  used  properly  and  if  programs  are  conducted 
consistent  with  applicable  laws  and  regulations. 

Grantees  or  federal  agencies  contract  directly  with  nonfederal  audi¬ 
tors — mostly  certified  public  accountants  (CP as) — to  audit  much  of 
these  funds.  These  auditors  assure  program  managers  that  they  have 
reliable  reports  on  (1)  the  financial  activities,  (2)  compliance  with  the 
requirements  of  laws  and  regulations,  and,  in  many  cases,  (3)  the  extent 
of  internal  controls  over  federal  expenditures.  This  report  addresses  the 
audit  quality  reviews  performed  by  inspectors  general  (igs)  in  many  of 
these  audits  of  federal  grants  to  state  and  local  governments,  and  single 
audits  of  entities  receiving  federal  funds  prior  to  passage  of  the  Single 
Audit  Act  of  1984. 

This  review  was  performed  at  the  request  of  Jack  Brooks,  Chairman, 
Legislation  and  National  Security  Subcommittee,  House  Committee  on 
Government  Operations.  The  subcommittee  has  a  long-standing  interest 
and  commitment  to  audit  quality.  The  subcommittee  has  been  instru¬ 
mental  in  passage  of  legislation  in  this  area,  including  the  Single  Audit 
Act  of  1984  and  the  Inspector  General  Act  of  1978.  gao  shares  the  sub¬ 
committee’s  interest,  and  has  supported  these  legislative  initiatives.  We 
believe,  and  testified  before  the  subcommittee,  that  the  Single  Audit  Act 
will  go  a  long  way  towards  improving  the  audits  of  fede.  al  funds  and  in 
promoting  controls  over  and  management  of  those  funds. 

We  believe  it  is  essential  that,  as  the  Single  Audit  Act  is  implemented, 
measures  be  taken  to  avoid  problems  with  audit  quality  that  have  sur¬ 
faced  in  the  prior  grant-by -grant  and  single  audits.  Hence,  this  study 
was  undertaken  to  identify  those  problems  and  to  recommend  ways  to 
avoid  them  as  the  audit  community  moves  towards  implementing  the 
Single  Audit  Act. 

While  gao  has  raised  the  subject  of  audit  quality  in  many  reports  over 
the  past  two  decades'  ,  for  the  most  part,  those  reports  focused  on  prob¬ 
lems  of  selected  audits  in  several  agencies.  This  request — that  gao  study 


'Many  Proprietary  Schools  Do  Not  Comply  With  the  Department  of  Education's  Pell  Grant  lYogram 
Requirements.  GAO/HKD-84- 1 7,  Aug  20,  1984. 
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CPA  Audits  of  Federally- Assisted  Programs 
Must  Be  Improved 


the  quality  of  audits  of  federal  grants  to  state  and  local  governments 
and  nonprofit  organizations — has  resulted  in  our  most  extensive  review 
of  audit  quality  issues  to  date. 

Because  of  the  magnitude  of  the  subcommittee’s  request,  gao  estab¬ 
lished  an  Audit  Quality  Task  Force  and  divided  its  review  work  into  two 
phases.  The  first  phase  was  aimed  at  evaluating  both  the  quality  of  the 
offices’  of  inspectors  general  audit  quality  review  systems  as  well  as 
reporting  on  the  results  of  the  igs’  reviews  of  audits  performed  by 
nonfederal  auditors.  The  second  phase  of  our  review  was  aimed  at 
determining  the  extent  to  which  certified  public  accountants  comply 
with  professional  auditing  standards  on  their  audits  of  recipients  of  fed¬ 
eral  assistance,  as  well  as  determining  the  overall  quality  of  their  audits. 

The  basic  question  we  want  to  address  in  these  two  phases  of  our 
review  is  whether  those  audits  are  conducted  in  a  manner  that  provides 
reasonable  assurance  that  any  problems  are  identified  and,  if  identified, 
are  properly  reported.  Our  first  phase  will  respond  to  this  question  by 
looking  at  what  the  IGS  do  to  answer  this  question  and  reporting  on  what 
their  answers  are.  In  our  second  phase,  we  will  review  and  assess  a  sam¬ 
ple  of  those  audits.  We  will  also  look  at  the  results  of  other  studies  that 
have  been  performed  in  this  area. 

This  report  focuses  on  the  first  phase  of  our  work — the  role  that  inspec¬ 
tors  general  play  in  the  audit  quality  review  process  and  the  results  of 
their  work.  It  will  describe  the  extent  to  which  the  igs  have  identified 
audit  quality  problems  during  their  reviews  of  audits,  and  discuss  some 
of  the  common  problems  identified.  It  will  also  describe  the  systems  the 
inspectors  general  have  in  place  to  review  audit  work  and  recommend 
ways  they  can  improve  their  audit  quality  review  systems  to  be  more 
effective. 

Before  discussing  our  review  results,  it  is  important  to  understand  two 
things.  First,  how  we  and  others  in  the  accounting  profession  define  a 
quality  audit,  and  second,  the  role  the  inspectors  general  play  in  assur¬ 
ing  audit  quality. 


Quality  Testing  of  Audits  of  Grantee's  Records-llow  It  Is  Done  by  Selected  Federal  Agencies  and 
What  Improvements  are  Needed.  FGMSD-79-38.  .July  19,  1979. 

Using  Independent  Public  Accountants  to  Audit  Ihiblic  Housing  Agcncies-An  Assessment. 
CKD-76-133,  Aug.  25,  1976 

Need  for  More  Effective  Audit  Activities.  IV 1305 15,  Apr  14,  1973. 
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What  Is  Audit  Quality? 


The  term  “audit  quality”  has  many  connotations.  In  the  context  of  our 
work,  we  define  “audit  quality”  as  compliance  with  professional  stan¬ 
dards  set  out  for  the  particular  type  of  audit  being  conducted.  To  help 
ensure  consistency  in  the  scope  and  quality  of  audit  work  and  prepara¬ 
tion  of  professional  and  meaningful  reports,  both  we  and  the  American 
Institute  of  Certified  Public  Accountants  (aicpa)  have  issued  standards 
that  auditors  must  follow. 

Over  the  years,  the  aicpa  has  set  auditing  standards  through  various 
committees,  and,  since  October  1978,  through  the  Auditing  Standards 
Board.  The  Auditing  Standards  Board  interprets  generally  accepted 
auditing  standards  through  “Statements  on  Auditing  Standards.”  These 
standards  apply  to  audits  performed  to  express  opinions  on  an  organiza¬ 
tion’s  financial  statements.  The  aicpa  also  issues  Industry  Audit  Guides 
and  other  material  to  assist  auditors  in  the  performance  of  their  work 
and  which  further  codify  auditing  standards  in  certain  specific  indus¬ 
tries,  such  as  state  and  local  governments. 

Auditing  standards  issued  by  gao  are  published  in  the  document  Stan¬ 
dards  for  Audit  of  Governmental  Organizations.  Programs,  Activities, 
and  Functions,  [1981  Revision]  commonly  referred  to  as  “Generally 
Accepted  Government  Auditing  Standards”  or  gagas.  Generally,  audi¬ 
tors  must  follow  these  auditing  standards  on  audits  of  recipients  of  fed¬ 
eral  funds  received  by  contractors,  nonprofit  organizations,  and  other 
external  organizations.  These  standards  are  broader  in  scope  than  those 
set  by  the  aicpa  and  cover  economy  and  efficiency  and  program  results 
work,  as  well  as  financial  statement  audits.  In  the  area  of  financial 
statement  audits,  these  standards  have  one  significant  difference  from 
the  aicpa’ s  standards,  gagas  requires,  in  addition  to  an  opinion  on  finan¬ 
cial  statements,  a  statement  on  internal  controls  and  a  statement  on 
compliance  with  laws  and  regulations. 

In  regard  to  the  issues  of  internal  control  and  compliance  work  and  the 
difference  between  so  called  “commercial”  audit  standards  and  any 
“government”  audit  standards,  it  should  be  noted  that  the  primary  dis¬ 
tinction  is  in  reporting  requirements — not  audit  requirements.  All  audit¬ 
ing  standards  require  that  important  internal  controls  be  evaluated 
either  directly  through  internal  control  reviews  or  indirectly  through 
expanded  substantive  testing.  Likewise,  if  significant  funds  are  received 
under  a  contract,  grant,  or  other  similar  arrangement  which  requires 
compliance  with  specific  contractual  or  legal  terms,  then  compliance 
testing  is  required  since  noncompliance  can  result  in  a  significant  impact 
on  the  entity  being  audited. 
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IG’s  Role  in  Assuring 
Audit  Quality 


In  conducting  the  audit  of  an  entity  or  a  grantee,  under  gagas,  the  audi¬ 
tor  must  conduct  a  review  of  compliance  in  accordance  with  laws  and 
regulations  and  at  least  a  preliminary  review  of  the  entities'  internal 
accounting  controls.  The  auditor’s  report  must  contain  a  statement  on 
the  entity’s  compliance,  including  identifying  material  instances  of  non- 
compliance,  and  a  statement  on  internal  accounting  controls  reviewed. 
The  federal  agencies  rely  on  these  two  sections  of  the  auditor’s  report  to 
assure  that  the  audited  entity  is  managing  the  programs  in  compliance 
with  federal  laws  and  regulations.  These  requirements  were  clarified 
and  amplified  in  the  Single  Audit  Act  of  1984,  particularly  in  the  areas 
of  compliance,  and  accounting  and  administrative  controls. 

The  Inspector  General  Act  of  1978,  as  amended,  requires  that  the 
inspectors  general  take  appropriate  steps  to  ensure  that  any  work  per¬ 
formed  by  nonfederal  auditors  of  federal  organizations’  programs,  activ¬ 
ities,  and  functions  complies  with  these  standards.  As  a  result, 
requirements  for  following  gagas  when  performing  audits  of  federal 
funds  have  generally  been  included  in  audit  contracts  or  engagement 
letters. 

In  addition  to  these  applicable  professional  standards,  audits  are  often 
subject  to  the  provisions  of  program  audit  guides  or  other  guidance  pro¬ 
vided  to  the  CPA  by  the  federal  agencies  or  the  entity  under  audit  at  the 
time  a  contract  is  signed.  Audit  guides  typically  set  out  a  framework  for 
conducting  and  reporting  on  an  audit  engagement  and  normally  include 
detailed  steps  and  suggested  language  auditors  should  follow.  Audit 
guides  for  specific  programs  are  normally  prepared  by  the  agency 
inspectors  general. 


The  igs  have  played  an  important  role  in  reviewing  audit  reports  for 
adherence  to  professional  standards.  Section  4(b)(3)  of  the  Inspector 
General  Act  of  1978  states  that  inspectors  general  will  “take  appropri¬ 
ate  steps  to  assure  that  any  work  performed  by  non-federal  auditors 
complies  with  the  standards  established  by  the  Comptroller  General...." 
The  act  only  addresses  the  igs’  audit  quality  review  function  in  general 
terms,  and  does  not  specify  the  steps  the  inspectors  general  must  take  to 
accomplish  this  function. 

We  have  identified  15  elements  which  constitute  a  typical  ig  quality 
review  process.  They  compose  the  process  against  which  we  evaluated 
the  igs'  activities  and  are  discussed  in  detail  later. 
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The  scope  of  gao’s  work  consisted  of  analyzing  the  results  of  indepen¬ 
dent  random  samples  of  desk  reviews  and  quality  control  reviews  at 
seven  igs.  It  also  included  an  evaluation  of  these  igs’  audit  quality 
review  systems  to  determine  the  ways  they  assure  that  work  performed 
by  nonfederal  auditors  complies  with  generally  accepted  government 
auditing  standards.  We  selected  the  following  seven  agencies'  igs  for  our 
review: 

•  The  Department  of  Agriculture  (I'sda), 

•  The  Department  of  Education  (Education). 

•  The  Department  of  Health  and  Human  Services  ( mis). 

•  The  Department  of  Housing  and  Urban  Development  ( urn), 

•  The  Department  of  Labor  (dol), 

•  The  Department  of  Transportation  (dot),  and, 

•  The  Environmental  Protection  Agency  (era). 

These  agencies  were  chosen  for  our  study  because  they  administered 
programs  accounting  for  95  percent  of  all  domestic  federal  assistance  in 
fiscal  year  1984. 

The  igs  decentralized  the  audit  quality  review  function  to  their  regional 
offices.  Consequently,  we  conducted  the  majority  of  our  work  at  these 
igs’  offices  in  seven  regions.  Because  some  igs  did  not  have  offices  in  all 
seven  regions  we  visited,  this  report  is  based  on  work  performed  at  a 
total  of  46  ig  regional  offices  (rigs). 

Our  first  objective  was  to  compile  and  report  on  the  results  of  the  rigs’ 
desk  reviews  and  quality  control  reviews  of  audit  reports  received  dur¬ 
ing  fiscal  year  1984.  To  accomplish  this,  we  determined,  through  discus¬ 
sions  with  regional  officials  and  examinations  of  report  logs,  the  number 
of  desk  reviews  performed  by  rigs  at  the  46  locations.  We  then  deter¬ 
mined  the  number  of  quality  control  reviews  performed  on  these  audits, 
based  on  input  logs  and  other  records.  Based  on  our  work,  we  estimate 
that  the  46  rigs  desk  reviewed  9,530  reports  in  fiscal  year  1984  and 
performed  quality  control  reviews  on  885  of  these  audits.  Our  estimates 
are  based  on  a  95  percent  confidence  level  with  a  sampling  error  of 
between  5  and  6  percent. 

Reports  reviewed  for  quality  by  the  inspectors  general  constitute  only  a 
portion  of  all  audits  performed  on  federal  funds.  In  fact,  approximately 
25,000  audits  came  to  our  attention  that  are  reviewed  at  the  state  level 
or  by  federal  program  officials  and  that  are  not  in  the  scope  of  our 


Objectives,  Scope,  and 
Methodology 
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The  Results  of  Regional 
Inspector  General 
Audit  Quality  Reviews 


review.  The  majority  of  these  audits  are  of  hud  housing  projects  which 
are  reviewed  by  program  offices. 

In  order  to  compile  the  results  of  the  igs’  reviews,  we  used  a  standard¬ 
ized  data  collection  instrument  to  record  the  igs’  findings.  In  reviewing 
each  report,  we  examined  correspondence,  checklists,  and  all  other  doc¬ 
uments  in  the  case  file.  We  attempted  to  relate  problems  identified  by 
the  rigs  to  gagas,  but  because  the  igs’  reviews  were  often  not  tied  to 
these  standards,  it  was  often  necessary  for  us  to  determine  the  applica¬ 
ble  standards  affected  based  on  our  best  judgment  after  reviewing  the 
case  files. 

Our  second  objective  was  to  identify  the  systems  the  rigs  have  to  assure 
that  nonfederal  auditors  comply  with  generally  accepted  government 
auditing  standards.  To  do  this,  we  identified  1 5  elements  in  a  typical 
audit  quality  review  system  based  on  our  discussions  with  officials  in 
the  IG  community  and  through  our  examination  of  the  igs’  current  poli¬ 
cies  for  assuring  audit  quality.  We  collected  data  with  respect  to  all  15 
elements,  but  concentrated  our  analysis  on  ten  elements  we  believed 
were  most  critical  to  an  effective  system.  Our  results  were  based  on  dis¬ 
cussions  with  rig  officials  at  the  46  locations  we  visited,  a  review  of  IG 
policies  and  procedures  at  the  regional  level,  and  our  own  testing  to  ver¬ 
ify  how  well  the  systems  were,  in  fact,  working.  The  results  of  this 
aspect  of  our  work  are  generally  reported  for  IG  regional  offices,  rather 
than  for  agency  igs  as  a  whole. 


rigs  have  audit  quality  review  systems  that  are  primarily  designed  to 
detect  and  correct  problems  of  unacceptable  work  on  individual  audits. 
As  a  major  part  of  those  systems,  rigs  perform  desk  reviews  and  quality 
control  reviews. 

A  desk  review  is  a  review  of  an  audit  report  for  conformity  with  profes¬ 
sional  standards — usually  reporting  standards — and  for  identification 
of  items  needing  clarification.  Desk  reviews  are  typically  performed  for 
one  other  important  reason,  and  that  is  to  identify  and  record  audit  find¬ 
ings  in  the  report  that  have  to  be  resolved  by  the  program  managers. 
Desk  reviews  are  limited  to  a  review  of  the  audit  report  itself,  and  do 
not  include  reviews  of  the  auditor’s  supporting  working  papers.  Hence, 
they  are  not  designed  to  enable  the  rigs  to  directly  evaluate  the  quality 
of  the  audit  performed. 
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Results  of  RIG’s  Desk 
Reviews  of  Audit 
Reports 


A  quality  control  review,  on  the  other  hand,  includes  a  review  of  the 
auditor’s  working  papers  to  ensure  that  the  audit  conforms  with  all 
applicable  professional  standards.  Typically,  quality  control  reviews 
involve  substantially  more  time  and  effort  on  the  part  of  igs  than  do 
desk  reviews. 

The  rigs  typically  desk  reviewed  100  percent  of  the  audits  they 
received.  They  usually  conducted  quality  control  reviews  on  at  least  5 
percent  of  these  audits.  The  decision  regarding  which  audits  to  subject 
to  quality  control  review  is  largely  judgmental  and  is  generally  based  on 
criteria  such  as  institutional  memory  of  prior  RIG  experience  with  the 
cpa  firm,  the  results  of  the  rig’s  desk  review  of  the  report,  and  whether 
the  firm  has  ever  previously  contracted  to  provide  audit  services  for  the 
agency. 

The  rigs’  audit  quality  review  systems  enable  the  rigs  to  identify  and 
have  the  auditors  take  corrective  action  on  numerous  cases  of  audit 
work  they  would  not  accept.  However,  since  these  results,  for  the  most 
part,  remain  in  the  individual  case  files,  regional  or  headquarters  offi¬ 
cials  generally  do  not  know  the  extent  or  type  of  problems  being  identi¬ 
fied  by  the  reviews.  We  therefore  compiled  the  following  results  from 
the  rigs’  case  files.  Although  we  did  not  verify  the  accuracy  of  the  rigs’ 
individual  reviews,  based  on  our  review  of  correspondence  between  the 
rigs  and  the  cpa  firms,  they  generally  appear  to  have  been  adequately 
performed. 


Our  analysis  of  the  audit  reports  reviewed  in  our  sample  indicated  that 
the  rigs  had  problems  with  25  percent  of  those  reports.  We  estimate 
that  the  rigs  had  problems  with  2,410  of  the  9,530  audits  they  desk 
reviewed.2 

The  problems  identified  by  the  rigs  concerned  the  way  the  reports  were 
presented  and  ranged  from  leaving  off  the  date  of  the  report  to  omitting 
a  required  statement  on  compliance  with  laws  and  regulations.  Gener¬ 
ally,  the  rigs  were  successful  in  having  auditors  correct  their  reports. 


2Estimated  with  95  percent  confidence  that  the  rate  of  occurrence  of  problem  audita,  taken  as  a 
percentage  of  all  audits  that  IGs  desk  reviewed,  was  25.3  percent  with  a  sampling  error  of  5.0 
percent. 
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Statement  on  Compliance 
With  Laws  and  Regulations 


We  reviewed  a  sample  of  328  audits  and  identified  84  where  the  rigs 
found  problems3  related  to  standards  requiring  the  auditors  to: 

identify  instances  of  noncompliance  with  laws  and  regulations  (42 
reports), 

identify  internal  controls  studied  and  evaluated  (19  reports), 

use  due  professional  care  in  preparing  audit  reports  (65  reports),  and 

correctly  cite  the  auditing  standards  followed  (18  reports). 

Because  a  desk  review  is  limited  to  a  review  of  the  report  only  and  not 
the  working  papers,  it  usually  does  not  enable  the  RIG  to  identify  prob¬ 
lems  regarding  the  work  itself.  The  work  itself  is  only  evaluated  in  a 
quality  control  review.  Our  analysis  of  the  results  of  the  rigs’  quality 
control  reviews  is  discussed  later  in  this  statement. 


In  governmental  auditing,  compliance  with  laws  and  regulations  is  sig¬ 
nificant  because  government  organizations,  programs,  activities,  and 
functions  are  usually  created  by  law  and  have  more  specific  rules  and 
regulations  than  do  private  organizations.  Generally  accepted  govern¬ 
ment  auditing  standards  require  auditors  to  include  in  their  reports  a 
statement  of  positive  assurance  on  those  items  of  compliance  with  laws 
and  regulations  they  tested,  a  statement  of  negative  assurance  on  those 
items  they  did  not  test,  and  a  description  of  material  instances  of  non- 
compliance  and  instances  or  indications  of  fraud,  abuse,  or  illegal  acts 
they  found  during  or  in  connection  with  their  audit. 

Positive  assurance  consists  of  a  statement  by  the  auditors  that  the 
tested  items  were  in  compliance  with  applicable  laws  and  regulations. 
Negative  assurance  is  a  statement  that  nothing  came  to  the  auditor's 
attention,  as  a  result  of  specified  procedures,  that  would  cause  the  audi¬ 
tors  to  believe  the  untested  items  were  not  in  compliance  with  applica¬ 
ble  laws  and  regulations. 

Many  of  the  problems  rigs  had  with  auditors’  reports  related  to  state¬ 
ments  on  compliance.  For  example,  rigs  found  reports  which  did  not 
include  a  statement  on  compliance.  Other  reports  included  a  general 
statement  but  omitted  either  the  statement  of  positive  assurance  or  the 
statement  of  negative  assurance,  rigs  also  identified  numerous  instances 
where  auditors  failed  to  report,  or  inadequately  reported  findings  of 


:lThe  sum  of  these  reports  exceeds  84  because  some  reports  had  problems  related  to  more  than  one 
standard, 
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noncompliance  with  laws  and  regulations.  Without  the  statement  on 
compliance,  the  cpa  does  not  attest  to  having  performed  the  required 
work  in  this  important  area. 


Statement  on  Internal  Generally  accepted  government  auditing  standards  normally  require 

Controls  auditors  to  study  and  evaluate  internal  accounting  controls  and  report 

thereon,  as  part  of  financial  and  compliance  audits.  A  study  and  evalua¬ 
tion  of  internal  controls  establishes  a  basis  for  determining  the  extent  of 
auditing  procedures  to  be  used  and  is  an  important  step  in  forming  an 
opinion  on  the  financial  statements.  The  reports  should  identify  the 
entity’s  significant  accounting  controls,  the  controls  evaluated,  the  con¬ 
trols  not  evaluated  and  the  reasons  therefore,  and  any  material  control 
weaknesses  identified. 

rigs  had  problems  with  many  auditors’  reports  relating  to  internal 
accounting  control  reporting.  For  example,  rigs  found  reports  which 
included  no  statement  on  internal  accounting  controls.  Other  reports 
included  a  statement  on  controls,  but  did  not  identify  the  entity’s  signifi¬ 
cant  controls,  or  having  identified  the  controls,  did  not  identify  the  con¬ 
trols  that  were  evaluated. 


Due  Professional  Care  Generally  accepted  government  auditing  standards  require  auditors  to 

use  due  professional  care  in  preparing  audit  reports.  Due  professional 
care  requires  professional  performance  of  a  quality  appropriate  for  the 
audit  assignment  undertaken.  It  also  means  using  good  judgment  in  pre¬ 
paring  audit  reports. 

Many  of  the  problems  rigs  had  with  auditors’  reports  related  to  due  pro¬ 
fessional  care.  For  example,  rigs  found  instances  where  the  auditors’ 
reports  contained  financial  statements  with  unexplained  inaccuracies, 
such  as  accounts  not  in  balance,  incorrect  accounts,  incorrect  adjusting 
entries,  and  improper  reporting  formats.  There  were  audit  reports  with 
missing  schedules,  missing  information,  and  inadequate  descriptions  of 
the  scope  of  audit  work  performed.  Other  reports  omitted  the  date  of 
the  report,4  did  not  contain  the  auditor's  signature,  or  did  not  properly 
cite  the  agency  guidance  followed  in  the  conduct  of  the  audit. 


40mitting  the  date  from  the  audit  report  is  not  an  insignificant  item  because  the  auditor  is  required  to 
disclose  events  that  occur  between  the  date  of  the  financial  statements  and  the  date  of  the  report  that 
have  a  material  effect  on  the  financial  statements. 
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Statement  on  Auditing 
Standards  Followed 


Audit  Quality  Control 
Reviews 


Generally  accepted  government  auditing  standards  require  auditors  to 
state  in  their  reports  that  their  examination  was  made  in  accordance 
with  such  standards,  rigs  identified  reports  that  did  not  cite  generally 
accepted  government  auditing  standards,  did  not  cite  any  standards,  or 
cited  the  standards  but  referenced  standards  that  had  been  superceded. 
Without  the  correct  citations,  the  reader  is  not  clear  as  to  the  standards 
against  which  the  cpa  maintains  the  audit  was  conducted. 

We  believe  that  the  results  of  the  rigs’  desk  reviews  indicate  a  lack  of 
awareness  by  cpa’s  of  gagas  reporting  standards  and  other  require¬ 
ments  for  governmental  audits.  Given  these  results  and  the  importance 
of  performing  desk  reviews  to  identify  audit  findings  for  resolution,  we 
believe  that  desk  reviews  should  continue  to  be  an  integral  part  of  rigs’ 
audit  quality  review  systems.  Further,  as  explained  in  the  next  section 
of  this  report,  we  believe  igs  can  better  use  desk  review  results  to  pre¬ 
vent  audit  quality  problems  from  recurring. 


rigs  normally  performed  quality  control  reviews  on  at  least  5  percent  of 
those  reports  desk  reviewed,  but  the  percentage  varied  widely  among 
agencies.  As  described  earlier,  the  rigs  did  not  usually  select  audits  for 
quality  control  review  on  a  random  basis.  They  selected  audits  largely 
based  on  their  judgment  as  to  which  firms  were  more  likely  to  have 
problems.  Consequently,  the  results  of  rigs’  quality  control  reviews  are 
not  necessarily  indicative  of  the  frequency  of  problems  in  the  universe 
of  audits  performed  by  cpas  as  a  whole.  Rather,  they  are  skewed 
towards  a  higher  level  of  problem  audits.  Despite  this,  we  believe  that 
the  results  of  rigs’  quality  control  reviews  indicate  that  serious  prob¬ 
lems  occur  in  a  substantial  number  of  governmental  audits. 

To  determine  the  results  of  the  rigs'  quality  control  reviews  of  audits, 
we  selected  independent  random  samples  of  audits  that  we  determined 
from  ig  records  had  been  quality  control  reviewed  at  the  46  regional  IG 
offices.  From  an  analysis  of  these  samples,  we  estimate  that  the  seven 
igs  conducted  885  quality  control  reviews.5  We  further  estimate  that  the 
rigs  identified  problems  with  399,  or  about  45  percent  of  these  reviews. 


5 Estimated  with  95  percent  confidence  that  the  rate  of  occurrence  taken  as  a  percentage  of  all  audits 
the  IGs  quality  control  reviewed  was  45. 1  percent  with  a  sampling  error  of  5.8  percent 
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Furthermore,  the  rigs  did  not  accept,  as  submitted,  about  22  percent6  of 
the  audits.  In  other  words,  one  out  of  every  five  audits  the  rigs  quality 
control  reviewed  was  not  accepted  until  the  auditor  (1)  performed  more 
audit  work,  (2)  clarified  work  performed,  or  (3)  provided  more  support 
for  the  audit  work  performed.  A  few  were  in  fact  never  accepted. 
Audits  that  were  not  accepted  by  the  rigs  most  often  involved  failings 
related  to  the  standard  requiring  the  auditors  to  obtain  and  document 
sufficient  competent  evidential  matter  to  support  their  conclusions  and 
opinions. 


Evidence  Generally  accepted  government  auditing  standards  require  auditors  to 

obtain  sufficient,  competent,  evidential  matter  to  support  their  conclu¬ 
sions  and  opinions.  The  nature,  timing,  and  extent  of  the  procedures  to 
be  applied  on  a  particular  engagement  are  a  matter  of  professional  judg¬ 
ment  to  be  determined  by  the  auditor,  based  on  specific  circumstances. 
However,  the  procedures  adopted  should  be  adequate  to  achieve  the 
audit  objectives  developed  by  the  auditor,  and  the  evidential  matter 
obtained  should  be  sufficient  for  the  auditor  to  form  conclusions.  The 
pertinence  of  the  evidence,  its  objectivity,  its  timeliness,  and  the  exis¬ 
tence  of  other  evidential  matter  corroborating  the  conclusions  to  which 
it  leads,  all  bear  on  its  competence. 

A  written  record  of  auditors’  evidence  must  be  retained  in  the  form  of 
working  papers.  As  a  general  rule,  working  papers  should  contain  the 
results  and  scope  of  auditors’  examinations  and  be  clear  and  under¬ 
standable  so  that  they  do  not  require  detailed,  supplementary,  oral 
explanations.  While  the  quantity,  type,  and  content  of  working  papers 
vary  with  the  circumstances,  they  normally  should  include  evidence 
showing  that: 

•  Audit  work  has  been  adequately  planned  and  supervised. 

•  Testing  of  compliance  with  laws  and  regulations  has  been  performed 
and  exceptions  have  been  identified  and  resolved. 

•  Internal  accounting  controls  have  been  studied  and  evaluated. 

•  Accounting  transactions,  balances  and  financial  items,  and  any  related 
evidential  matter  have  been  examined. 

Insufficient  evidence  was  the  most  common  problem  rigs  found  in  audits 
they  would  not  accept,  rigs  found  audits  where  there  was  little  or  no 


6Estimated  with  95  percent  confidence  that  the  rate  of  (X'ctirrence  taken  as  a  percentage  of  all  audits 
the  IGs  quality  control  reviewed  was  22.4  percent  with  a  sampling  error  of  4.9  percent. 
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Examples  of  Unaccepted 
Audits 


evidence  showing  that  the  auditors  properly  planned  the  audit  or  super¬ 
vised  and  reviewed  the  audit,  rigs  found  audits  where  there  was  little  or 
no  evidence  showing  testing  of  compliance  with  laws  and  regulations.  At 
least  two-thirds  of  the  audits  with  evidence  problems  involved  problems 
in  the  compliance  area;  either  the  evidence  was  lacking  or,  more  signifi¬ 
cantly,  no  or  inadequate  testing  of  compliance  was  done,  rigs  also  found 
audits  where  there  was  insufficient  evidence  documenting  the  auditors’ 
study  and  evaluation  of  internal  controls;  again,  either  the  evidence  was 
lacking  or  the  work  was  not  performed.  In  addition,  rigs  found  audits 
where  there  was  insufficient  evidence  of  auditors’  testing  of  financial 
operations  or  transactions. 

The  aicpa  has  also  identified  problems  in  audits  of  federal  funds  by 
cpas.  In  a  study  begun  in  late  1979  with  a  final  report  issued  in  1984, 
the  aicpa’s  Ethics  Division  found  problems  related  to  professional  stan¬ 
dards  on  nearly  half  of  two  hundred  reports  submitted  to  it  by  federal 
inspectors  general.  These  reports  were  selected  by  the  rigs  based  largely 
on  their  preliminary  review,  and  therefore,  were  part  of  a  judgmental, 
rather  than  a  statistically  valid  random  sample.  The  results,  however, 
are  similar  to  what  the  igs’  quality  control  reviews  continue  to  disclose. 

In  this  study,  the  aicpa  investigated  106  cases  which  resulted  in  the  fol¬ 
lowing  actions: 

•  Four  were  referred  to  the  trial  board  for  disciplinary  action. 

•  Twenty -three  were  given  administrative  reprimands  of  which  21 
required  CPAs  to  take  continuing  professional  education  credits,  and  in 
some  of  those  instances,  have  their  future  work  reviewed. 

•  Sixty-four  were  sent  letters  of  constructive  comment  for  improvement 
in  future  audits. 

•  No  action  was  taken  on  15  cases. 


Described  below  are  illustrations  of  audits  rigs  did  not  initially  accept. 
The  examples  include  problems  related  to  evidence,  as  well  as  other 
standards. 

•  In  Tennessee,  a  CPA  contracted  to  perform  an  audit  of  a  city’s  housing 
authority.  The  Atlanta  hud  regional  ig  rejected  the  audit  report  because 
the  rig  determined  that  there  was  (1)  no  evidence  in  the  working  papers 
of  supervision  of  the  audit,  (2)  insufficient  support  for  the  findings  and 
conclusions,  (3)  insufficient  evidence  that  required  tests  to  determine 
compliance  with  laws  and  regulations  were  made,  and  (4)  insufficient 
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evidence  of  the  auditor’s  study  and  evaluation  of  internal  controls  over 
accounting  records  and  financial  reporting  procedures,  cash  receipts  and 
disbursements,  investment  of  excess  funds,  submission  of  funds  due 
hud,  and  budgetary  controls.  These  problems  were  noted  in  a  quality 
control  review  performed  after  the  auditor  did  not  respond  to  problems 
noted  by  the  RIG  in  his  desk  review  of  the  audit  report. 

•  An  hhs  rig  found  that  a  cpa  firm  contracted  to  audit  a  Colorado  Head 
Start  grant  and  one  of  its  staff  members  hired  the  Head  Start  program’s 
bookkeeper  to  assist  in  the  audit.  In  addition  to  noting  the  lack  of  inde¬ 
pendence,  the  rig  noted  that  no  internal  control  work  was  performed 
and  that  only  part  of  the  required  testing  for  compliance  with  laws  and 
regulations  was  completed.  The  cpa  firm’s  staff  member  responded  that 
since  he  personally  designed  and  implemented  the  system  of  internal 
control  for  the  program,  there  was  no  need  to  question  or  test  the  inter¬ 
nal  control  system.  The  cpa  completed  the  additional  compliance  tests, 
and  the  rig  issued  the  report  cautioning  program  officials  to  be  careful 
about  relying  on  the  report  due  to  the  question  of  independence. 

•  In  New  York,  on  an  audit  of  an  educational  institution,  the  Education  rig 
found  that  the  required  compliance  and  internal  control  work  was  not 
properly  documented  by  the  auditor.  In  his  report,  the  auditor  included 
required  statements  that  he  performed  all  work  in  accordance  with  pro¬ 
fessional  standards,  even  though  that  was  not  the  case.  The  auditor  did 
not  submit  required  documentation  to  satisfy  the  ig  that  additional  work 
was  performed.  The  ig  subsequently  performed  additional  work  and 
found  poor  internal  controls  and  material  cases  of  noncompliance  with 
program  regulations.  The  oig  rejected  the  report  and  referred  the  cpa  to 
the  New  York  State  Board  of  Accountancy  and  the  aicpa. 

•  In  Texas,  a  cpa  contracted  to  perform  a  single  au  lit  of  a  city.  The  Fort 
Worth  hud  regional  rig  would  not  accept  the  audit  report  because  he 
found  ( 1 )  no  evidence  of  supervision,  (2)  insufficient  evidence  that 
required  tests  to  determine  compliance  with  laws  and  regulations  were 
made,  (3)  insufficient  documentation  of  the  auditor's  study  and  evalua¬ 
tion  of  internal  controls  to  clearly  show  the  relationship  between  the 
review  of  internal  accounting  controls  and  substantive  testing,  and  (4) 
financial  information  in  the  report  that  could  not  be  reconciled.  The  rig, 
in  July  1984  and  October  1984,  asked  the  cpa  to  revise  his  report  and 
perform  additional  work  based  on  the  results  of  a  desk  review  and  qual¬ 
ity  control  review,  respectively.  The  rig  finally  accepted  and  issued  the 
report  in  May  1985. 
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Improvements  Should 
Be  Made  to  Assure 
Better  RIG  Monitoring 
of  CPA  Audits 


The  prior  section  described  some  of  the  rigs’  audit  quality  review  results 
and  explained  the  types  of  problems  noted  in  the  rigs’  desk  and  quality 
control  reviews.  With  the  full  implementation  of  the  Single  Audit  Act  of 
1984,  greater  audit  coverage  will  be  devoted  to  federal  funds.  Further, 
we  believe  that  the  audit  quality  review  function  will  continue  to  be  cru¬ 
cial  in  ensuring  that  auditors  understand  what  professional  standards 
and  other  guidance  they  need  to  follow  in  the  conduct  of  their  audits  as 
well  as  in  the  preparation  of  reliable  audit  reports. 

As  mentioned  earlier,  the  inspectors  general  are  required  to  take  appro¬ 
priate  steps  to  assure  that  nonfederal  auditors  comply  with  gagas,  but 
are  not  required  to  follow  specific  procedures  to  ensure  high  quality 
work  by  these  auditors.  We  studied  the  rigs’  existing  audit  quality 
review  systems  and  identified  the  key  elements  of  a  typical  system.  (See 
appendix  II.)  The  typical  system  that  we  identified  consisted  of  15  ele¬ 
ments  involving  the  three  stages  of  the  quality  review  process — secur¬ 
ing  audit  services  and  reports,  quality  review,  and  using  quality  review 
results. 

The  elements  were  developed,  in  part,  from  existing  agency  manuals, 
the  Office  of  Management  and  Budget  (omb)  Circular  A- 102  Compliance 
Supplement,  and  through  discussions  with  several  officials  in  the  IG 
community,  as  well  as  our  observations  at  the  46  rigs  we  visited.  We 
evaluated  the  rigs’  audit  quality  review  systems  focusing  on  10  of  the 
15  elements  that  we  determined  were  most  critical  to  an  effective  qual¬ 
ity  review  process.  We  interviewed  headquarters  and  rig  officials  to 
evaluate  how  they  assured  audit  quality,  reviewed  agency  guidance, 
and  tested  their  systems  to  see  how  well  they  were  working  in  relation 
to  our  10  elements. 

Our  work  showed  that  the  headquarters  igs  decentralized  much  of  the 
audit  quality  review  function  to  the  rigs.  Although  we  found  that  each 
headquarters  IG  had  provided  regions  with  some  written  guidance  on 
performing  this  function,  the  46  regions  we  visited  were,  for  the  most 
part,  developing  and  implementing  their  audit  quality  review  systems 
locally.  We  found  that  all  of  the  rigs  had  some  type  of  audit  quality 
review  system  to  assure  the  quality  of  work  by  nonfederal  auditors  but 
the  scope  of  work  varied  significantly  among  regions. 

Based  upon  our  review,  we  believe  that  the  rigs  could  be  more  effective 
in  identifying  and  combating  poor  audits  if  they  improved  their  systems 
in  areas  related  to  these  10  elements.  Specifically,  we  believe  the  igs 
could  do  more  to 
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Some  Audit  Guides  Included 
Outdated  Report  Language 


provide  accurate  written  guidance  to  grantees  and  cpas  to  assure  com¬ 
pliance  with  gagas  (element  3), 

improve  desk  and  quality  control  review  programs,  specifically  in  the 
scope  and  format  of  the  checklist  guidance  the  rigs  use  to  identify  qual¬ 
ity  problems  (elements  5,  6,  and  7), 

take  more  frequent  actions  against  cpas  to  increase  the  reliability  of 
audit  reports  (element  9), 

compile  and  analyze  the  results  of  audit  quality  reviews  at  the  regional 
level  to  identify  and  act  to  prevent  recurring  quality  problems  (elements 
10,  12  and  13),  and 

require  regional  offices  to  report  on  problem  audits  to  headquarters  so 
that  headquarters  can  advise  the  Congress  on  its  efforts  to  monitor 
audit  quality  (elements  14  and  15). 


The  inspectors  general  help  assure  audit  quality  through  their  prepara¬ 
tion  of  program  audit  guides,  which  are  distributed  to  most  cpa  firms  at 
the  beginning  of  the  audit  engagement.  The  audit  guides  often  include 
detailed  requirements  for  performing  audits  and  reporting  audit  results, 
including  specific  audit  procedures  and  suggested  report  language,  cpas 
rely  on  audit  guides,  in  addition  to  applicable  professional  standards,  to 
plan  and  carry  out  their  audit  work. 

We  evaluated  1 1  of  the  audit  guides  that  are  widely  used  at  the  46  RIG 
offices.  We  determined  whether  the  selected  audit  guides  (1)  specified 
audit  objectives,  (2)  listed  audit  procedures  for  testing  compliance,  and 
(3)  included  the  appropriate  reporting  requirements.  In  our  evaluation 
of  the  universe  of  9,530  reports  desk  reviewed  by  inspectors  general  at 
the  seven  federal  agencies,  we  found  that  outdated  audit  guides  contrib¬ 
uted  to  some  audit  reports  not  satisfying  the  reporting  standards  speci¬ 
fied  in  GAGAS. 


We  found  that  8  of  the  1 1  program  audit  guides  we  reviewed  at  six7  IGs 
did  not  reference  the  current  ( 1981 )  version  of  gagas — the  year  sub¬ 
stantial  revisions  were  made  to  these  standards.8  As  a  result,  the  audit 

'  DOT  regional  officials  told  us  they  did  not  provide  CPAs  with  audit  guides  for  audits  of  their  grant 
programs. 

8These  standards  have  been  revised  in  order  to 

— expand  the  explanations  of  some  standards  in  response  to  questions  about  them. 

— separate  the  standards  for  financial  and  compliance  audits  from  those  for  economy  and  efficiency 
audits  and  program  results  audits. 

— incorporate  standards  relating  to  audits  in  which  automatic  data  processing  systems  are  used  by 
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guides  did  not  include  sample  audit  report  language  that  accurately  ref¬ 
erenced  gagas  and  that  was  consistent  with  reporting  standards  con¬ 
tained  in  gagas.  Since  audit  guides  were  relied  upon  by  CPAs  in  reporting 
the  results  of  their  work,  we  estimated,  from  our  reviews  of  audit 
reports,  that  79  percent,  or  about  7,500  of  the  estimated  9,530  reports9 
contained  inconsistencies  with  the  language  of  the  current  gagas  report¬ 
ing  standards  due  to  the  guides  being  inaccurate  or  outdated.  When 
audit  reports  do  not  contain  language  consistent  with  established  stan¬ 
dards,  the  nature,  extent,  and  results  of  the  auditors’  examinations  have 
not  been  adequately  disclosed  to  the  users,  even  though  the  audit  may 
have  been  conducted  in  accordance  with  standards. 

We  found  audit  reports  that  contained  improper  report  language  from 
outdated  audit  guides.  The  following  three  reporting  standards  were 
among  those  most  often  violated: 

•  A  statement  shall  be  included  in  the  auditors’  reports  that  the  examina¬ 
tion  was  made  in  accordance  with  generally  accepted  government  audit¬ 
ing  standards  for  financial  and  compliance  audits. 

•  [gao  Note:  Reports  did  not  properly  reference  gagas — 42  percent  of 
the  reports.] 

•  Either  the  auditors’  reports  on  the  entity’s  financial  statements  or  a  sep¬ 
arate  report  shall  contain  a  statement  of  positive  assurance  on  those 
items  of  compliance  tested  and  negative  assurance  on  those  items  not 
tested. 

•  [gao  Note:  Reports  did  not  include  statement  of  positive  and/or  nega¬ 
tive  assurance — 58  percent  of  the  reports.] 

•  The  auditors  shall  report  on  their  study  and  evaluation  of  internal  con¬ 
trols  made  as  part  of  the  financial  and  compliance  audit. 

•  [GAO  Note:  Reports  did  not  identify  the  significant  internal  accounting 
controls,  which  were  reviewed  and/or  identify  material  weaknesses 
found.  Others  did  not  include  an  explanation  of  why  the  auditor  chose 
not  to  study  and  evaluate  internal  controls — 72  percent  of  the  reports.] 


the  entity,  and 

— add  a  standard  to  make  more  specific  the  auditor's  responsibility  for  detecting  fraud  and  abuse  in 
government  programs  and  operation. 

^Estimated  with  95  percent  confidence  with  a  sampling  error  of  4  percent. 
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Improve  Desk  and 
Quality  Control  Review 
Program 


The  rigs  did  not  identify  the  above  inconsistencies  as  report  problems 
because  they  told  us  the  cpas  relied  on  guidance  the  rigs  had  prepared. 
Some  rig  officials  told  us  that  they  were  hesitant  to  revise  and  update 
their  audit  guides  because  they  believed  the  guides  would  become  obso¬ 
lete  after  implementation  of  the  single  audit  legislation.  However,  during 
our  study,  we  found  that  some  of  the  rigs  are  now  requiring  cpas  to 
follow  all  reporting  standards.  For  example,  in  one  mis  region,  audit 
reports  consistently  failed  to  include  gagas  reporting  requirements 
because  the  audit  firms  relied  on  a  prescribed  reporting  format  included 
in  the  Head  Start  Program  Audit  Guide.  An  mis  official  told  us  that  it 
now  requires  cpas  who  perform  audits  of  this  program  to  follow  all 
reporting  standards. 

We  believe  that  audit  firms  share  the  responsibility  for  issuing  audit 
reports  that  were  deficient  in  these  areas.  The  aicpa’s  Codification  of 
Statements  on  Auditing  Standards  states  that  auditors  should  make 
appropriate  revisions  to  prescribed  formats  which  do  not  incorporate 
current  reporting  standards.  The  1984  version  of  the  codification  states 
that  auditors  should  be  aware  of  the  latest  accounting  and  auditing  pro¬ 
nouncements  as  part  of  their  planning  efforts. 

Even  though  a  new  comprehensive  compliance  supplement,  suggesting 
audit  procedures,  will  generally  be  used  in  conjunction  with  single 
audits,  program  audit  guides  will  continue  to  be  applicable  in  many  situ¬ 
ations.  Specifically,  audit  guides  will  be  used  whenever  additional  audit 
work  is  undertaken  to  build  on  work  performed  in  a  single  audit,  or 
when  entities  who  are  eligible  to  choose  a  grant,  rather  than  single 
audit,  do  so.  We  believe  that  rigs  should  revise  their  program  audit 
guides  to  include  proper  references  to  reporting  standards  so  that 
reports  distributed  to  program  managers  are  properly  written.  We 
believe  that  this  guidance  is  the  best  opportunity  rigs  have  to  influence 
proper  reporting,  even  before  the  audit  gets  underway. 


We  believe  that  effective  desk  and  quality  control  reviews  are  essential 
to  the  rigs'  audit  quality  review  systems.  Desk  reviews  not  only  help 
rigs  identify  problems  with  report  language,  but  they  also  help  the  rigs 
select  potentially  problem  audit  firms  on  which  to  perform  quality  con¬ 
trol  reviews.  Since  rigs  have  limited  resources  available  for  this  activity 
reviews  must  be  effective  so  that  they  can  ensure  properly  written 
reports  and  emphasize  to  the  accounting  profession  the  importance  of 
producing  high  quality  work. 
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We  believe,  based  on  our  reviews  at  the  46  kigs  we  visited,  that  the  igs 
could  be  more  effective  in  the  desk  and  quality  control  review  function 
if  they  (1 )  required  all  of  their  rigs  to  perform  quality  control  reviews 
on  an  established  percentage  of  the  audit  reports  they  receive  and  (2) 
used  standardized  checklists  tied  to  the  professional  standards. 


Six  of  the  seven  igs  in  our  study  had  policies  requiring  quality  control 
reviews  on  at  least  5  percent  of  the  audit  reports  they  received.  The  sev¬ 
enth  ig  did  not  require  a  minimum  level  of  effort  in  its  quality  control 
review  program.  We  found  that  a  total  of  33  of  the  46  rigs  we  visited 
actually  performed  quality  control  reviews  on  at  least  5  percent  of  their 
reports.  The  following  chart  shows  the  range  of  effort  devoted  to  this 
activity. 


Table  1.1:  The  Number  of  RIGS  Performing  Quality  Control  Reviews  (By  Percentage  Categories  in  Fiscal  Year  1984) 

Agency 

Less  than 

5% 

5% 

Between  5% 
and  10% 

10% 

Over  10% 

Total 

Education 

1 

2 

3 

0 

1 

7 

DOLa 

5 

1 

0 

0 

0 

6 

DOT 

1 

0 

3 

0 

3 

7 

EPAa 

0 

0 

1 

0 

4 

5 

HHS 

3 

0 

3 

1 

0 

7 

HUD 

0 

0 

7 

0 

0 

7 

USDA 

3 

0 

0 

0 

4 

7 

Total 

13 

3 

17 

1 

12 

46 

aThese  IGs  did  not  have  offices  in  all  seven  regions  we  visited 


Several  rig  officials  told  us  that  the  number  of  quality  control  reviews 
they  performed  was  limited  by  the  amount  of  resources  available. 
Others  stated  that  they  considered  quality  review  to  be  a  low  priority  in 
their  region.  We  believe  that  the  benefits  realized — both  in  identifying 
potentially  problem  firms  and  in  ensuring  an  overall  high  level  of  qual¬ 
ity — warrant  resources  to  quality  control  an  established  percent  of  the 
reports  in  every  rig  office. 

While  any  percentage  is  arbitrary,  we  believe  that,  if  coupled  with  the 
analysis  and  recourse  steps  discussed  below,  the  percent  of  audits  qual¬ 
ity  control  reviewed  can  be  kept  relatively  low.  This  would  be  especially 
true,  in  our  opinion,  after  the  first  few  years  of  single  audits  under  the 
1984  act.  Further,  we  believe  target  goals  should  be  revised  as  experi¬ 
ence  is  gained  under  the  act. 


Establish  Goals  for  Quality 
Control  Reviews 
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Develop  More  Useful  and  Almost  all  of  the  4(3  rigs  relied  on  quality  control  review  checklists  to 
Consistent  Review  guide  their  reviewers  through  examinations  of  audit  reports  and  work- 

Checklists  i°g  PaPers  to  identify  problems  that  would  necessitate  revisions  to  the 

A  '  report,  additional  fieldwork,  or  additional  working  paper  documenta¬ 

tion.  A  checklist  or  other  similar  document  is  designed  to  ensure  that  the 
rig  reviewer  take  a  consistent  approach  to  his  review.  When  checklists 
are  not  used,  the  effectiveness  and  consistency  of  quality  reviews 
depend  upon  the  reviewers'  ability  to  independently  identify  deficien¬ 
cies  in  the  audit  and  audit  report  and  to  interpret  them  as  violations  of 
professional  standards. 

We  reviewed  an  unbiased,  judgmental  sample  of  checklists  to  determine 
if  the  same  ones  were  used  consistently  among  all  regions  of  each  ig  and 
to  see  if  they  related  problems  found  in  the  quality  review  to  violations 
of  professional  standards.  Our  sample  included  desk  review  and  quality 
control  checklists  for  both  grant  and  single  audits. 

We  found  that  none  of  the  agencies  had  checklists  that  were  used  at  all 
of  their  regional  offices  we  visited.  Many  regions  developed  their  own 
checklists  from  sections  of  others  or  adopted  checklists  which  were 
developed  by  professional  auditing  organizations  such  as  various  chap¬ 
ters  of  the  intergovernmental  audit  forums.  Some  rig  officials  explained 
that  checklists  were  not  required  or  provided  by  headquarters,  while 
others  told  us  that  they  believed  their  local  versions  were  more  detailed 
than  those  provided  by  their  headquarters  igs. 

Standardized  checklists  are  important,  in  our  view,  because  the  results 
of  quality  control  reviews  are  not  comparable  among  ig  regions  of  a  par¬ 
ticular  agency  if  their  emphasis  or  format  varies.  Moreover,  we  believe 
that  checklists  that  are  annotated  to  gagas  make  it  easier  for  the  rigs  to 
categorize  and  analyze  the  types  of  problems  found  in  unacceptable 
audits  so  that  measures  can  be  taken  to  inform  the  profession  about 
recurring  audit  quality  problems.  At  the  same  time,  we  would  emphasize 
that  the  checklist  evaluation  should  not  become  so  routine  that  the 
reviewer  approaches  the  task  by  “checking  the  boxes.”  We  believe  that 
reviewing  audit  reports  and  working  papers  are  processes  which  require 
professional  judgment  by  technically  skilled  reviewers. 

When  rigs  tie  problems  in  the  audit  and  audit  report  to  specific  elements 
of  a  standard,  we  believe  that  the  reviewer  is  greatly  assisted  in  forming 
his  judgments  about  the  quality  of  the  audit.  This  extends  also  to  deter¬ 
mining  whether  a  standard  was  actually  violated,  and  if  so,  the  severity 
of  the  violation. 
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During  our  review,  we  found  that  only  one  of  the  25  checklists  we 
examined  included  annotations  to  standards  and  elements  of  standards 
for  each  item  on  the  checklist.  Some  checklists  were  written  in  the  lan¬ 
guage  of  the  standards,  but  did  not  either  reference  the  standards  or 
provide  detailed  explanations  of  what  requirements  were  necessary  to 
meet  each  of  them.  Other  checklists  recommended  that  the  rig  reviewers 
become  familiar  with  professional  standards,  but  included  no  annotated 
references  in  case  the  reviewer  needed  more  detailed  explanation.  Cross 
referencing  RiG-identified  problems  to  standards  would,  in  our  view, 
help  the  cpa  to  better  understand  the  nature  of  the  problems  as  well  as 
the  authoritative  criteria  used  by  the  rig. 


RIGs  Should  Consider 
Taking  Actions  When 
Audit  Work  Is 
Unacceptable 


Currently,  the  rigs  focus  on  correcting  individual  audits  when  problems 
are  found.  We  believe  that  when  the  rigs  find  problems,  they  should  not 
only  have  the  audit  corrected  but,  depending  upon  the  severity  of  the 
problems,  consider  other  actions  ranging  from  a  management  letter  to 
referral  to  a  regulatory  or  professional  body.  Actions  taken  by  the  ig 
would  increase  the  audit  community’s  awareness  of  the  consequences  of 
performing  unacceptable  work,  and  should  ultimately  improve  th'1  qual¬ 
ity  of  audits  performed  of  recipients  of  federal  funds. 


The  actions  taken  by  the  rigs  when  audits  are  unacceptable,  in  our  view, 
should  relate  to  the  severity  of  the  problems  found.  They  can  range 
from  a  letter  to  the  auditor,  with  a  copy  to  the  auditee,  suggesting 
improvement  in  certain  areas,  to  a  recommendation  to  the  grantee  or 
contracting  official  that  the  auditor  not  be  considered  for  future  audits. 
In  cases  of  severe  problems — where  the  cpa  neglected  to  complete  much 
of  the  work  agreed  to  in  the  contract,  for  example — the  rig  should  con¬ 
sider  referring  the  auditor  to  regulatory  or  professional  bodies  such  as 
the  appropriate  state  board  of  accountancy  and/or  the  aicpa  Ethics 
Division. 


During  our  review,  we  ascertained  whether  the  rigs  had  policies  and 
procedures  for  taking  action  on  unacceptable  audits  and  under  what 
conditions  actions  were  taken.  In  addition,  we  discussed  with  rig  offi¬ 
cials  the  effectiveness  and  practicality  of  pursuing  various  actions 
against  cpas  when  work  was  unacceptable. 


RIGs  Concentrate  on  Having  We  found  that  the  basic  philosophy  of  most  rigs  was  to  work  with  the 
Audits  Corrected  auditor  to  obtain  an  acceptable  report — even  if  the  acceptable  version 

took  months  to  produce.  If  the  auditor  cooperated  with  the  ig  and  made 
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the  necessary  corrections,  the  ig  took  no  further  action,  even  when  the 
audit  was  initially  unacceptable  and  the  process  took  long  periods  of 
time.  We  found  that  the  rigs  spent  much  of  their  audit  quality  review 
time  working  with  cp as  when  the  cpas’  work  was  initially  deemed  unac¬ 
ceptable.  Although  some  auditors  were  very  responsive,  we  found  sev¬ 
eral  examples  where  the  auditors  took  more  than  4  months  to  satisfy 
the  rigs’  concerns  and  caused  the  rigs  to  expend  resources  tracking  or 
re-reviewing  auditors’  reports.  In  these  cases,  we  believe  the  usefulness 
of  a  subsequent  report  diminishes  greatly  as  time  passes,  especially  if 
the  grantee,  federal  program  manager,  or  the  public  relied  on  an  earlier 
incorrect  or  incomplete  version  of  the  audit  report. 

The  following  example  illustrates  these  problems: 

•  In  one  hud  regional  office,  the  rig  desk  reviewed  and  issued  an  audit 
report  of  a  local  housing  authority  in  June  1984.  The  audit  report  was 
issued  and,  shortly  thereafter,  a  quality  control  review  was  performed. 
The  rig  stated  in  a  letter  to  the  auditor  that  there  was  no  evidence  in  the 
working  papers  that  the  audit  was  planned  and  little  evidence  of  a 
supervisory  review  by  the  firm’s  partner.  Also,  the  rig  stated  that  it 
could  find  no  evidence  of  a  study  and  evaluation  of  internal  controls  or 
evidence  that  any  testing  of  compliance  with  laws  and  regulations  was 
performed.  Further,  the  IG  mentioned  that  the  working  papers  lacked 
sufficient,  competent,  evidential  matter  to  support  the  auditor’s  opinion 
on  the  financial  statements.  The  ig  dated  this  letter  September  21,  1984, 
and  asked  that  the  additional  documentation  be  provided  within  60 
days.  The  regional  ig  officials  also  asked  that  the  cpa  inform  them  if  the 
audit  report  would  be  revised  based  on  this  additional  documentation 
and/or  audit  work,  and  directed  that  if  it  was  revised,  it  should  be  dis¬ 
tributed  in  the  same  manner  as  the  original  report.  Seven  months  later, 
in  April  1985,  the  requested  working  papers  had  not  been  furnished  and 
the  original  audit  report  had  not  been  retracted. 

During  our  work,  we  inquired  into  the  reasons  rigs  are  reluctant  to  con¬ 
sider  actions  against  cpas.  A  few  rigs  expressed  concern  about  the  rela¬ 
tively  large  amount  of  resources  needed  in  pursuing  measures  against 
cpas.  Others  told  us  that  since  their  mandate  is  to  assure  audit  quality, 
they  believed  that  actions  against  cpas  would  create  an  adversary  rela¬ 
tionship  where  a  cooperative  one  was  more  effective. 

We  found  that  several  rigs  were  reluctant  to  refer  auditors  to  regulatory 
and/or  professional  bodies,  such  as  the  state  boards  of  accountancy  or 
the  aicpa  Ethics  Division.  Many  rigs  explained  that  although  they  have 
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agency  guidance  which  addresses  referrals,  they  seldom  need  to  take 
this  action  because  cpas  usually  make  the  required  adjustments  to  the 
audits.  A  few  rigs  are  concerned  about  the  resources —  especially  in 
regard  to  documentation  requirements — which  would  have  to  be 
devoted  to  the  referral  process. 

In  the  aicpa’s  1979  study,  the  agencies  submitting  audit  reports  sug¬ 
gested  that  the  aicpa  reveal  the  results  of  aicpa’s  individual  investiga¬ 
tions.  The  aicpa  Ethics  Division  decided  not  to  share  these  individual 
case  results  with  the  agencies,  and  to  continue  its  policy  of  conducting 
investigations  in  confidence,  except  for  trial  board  results.  We  believe 
the  policy  of  not  discussing  the  status  of  progress  of  referrals  contrib¬ 
utes  to  the  igs’  history  of  infrequent  referrals. 

A  case  in  the  HHS  New  York  region  is  representative  of  the  types  of  cases 
that,  in  our  opinion,  should  have  been  referred: 

•  The  RIG  quality  control  reviewed  an  audit  and  determined  that  ( 1 )  there 
was  not  evidence  of  proper  planning,  (2)  the  audit  work  was  poorly  doc¬ 
umented,  (3)  the  conclusions  lacked  sufficient  and  competent  support, 
and  (4)  the  auditor’s  working  papers  provided  little  evidence  that  inter¬ 
nal  control  and  compliance  reviews  were  made.  The  RIG  rejected  the 
audit  after  the  CPA  did  not  provide  the  required  documentation  within 
the  rig’s  time  frame  and  informed  the  grantee  that  another  audit  would 
be  required.  In  response  to  our  inquiry  about  why  the  auditor  was  never 
referred  to  a  professional  or  regulatory  body,  a  rig  official  told  us  that 
he  thought  rejecting  the  report  was  sufficient. 

We  believe  that  the  rigs’  approach  of  working  with  the  auditor  to  make 
the  report  acceptable  is  appropriate  when  problems  are  minor.  How¬ 
ever,  we  believe  that  for  more  serious  and  recurring  problems,  the  rig 
should  consider  taking  further  action,  even  when  the  auditor  is  willing 
to  make  the  corrections  necessary  to  make  the  audit  acceptable. 

We  believe  that  by  pursuing  actions  against  cpas  when  their  audits  are 
unacceptable,  auditors  would  become  more  aware  of  their  professional 
responsibilities  in  the  performance  of  governmental  audits.  We  believe 
that  this  increased  awareness  would  ultimately  improve  the  overall 
quality  of  audits. 
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We  believe  the  rigs  are  missing  an  opportunity  to  prevent  recurring 
audit  quality  problems  because  they  do  not  record  and  aggregate  the 
results  of  their  desk  and  quality  control  reviews.  For  the  most  part, 
their  efforts  have  focused  instead  on  detecting  audit  quality  problems 
on  a  case-by-case  basis  and  working  with  the  CP  as  to  have  the  problems 
corrected.  We  believe  that  in  addition  to  detecting  quality  problems  on 
individual  audits,  the  rigs  could  prevent  recurring  quality  problems  if 
they  recorded  and  compiled  historic  data  on  each  audit  firm’s  perform¬ 
ance  and  analyzed  the  results  of  their  quality  reviews  for  common 
trends  or  patterns. 

At  the  46  rig  offices,  we  determined  if  and  how  the  results  of  quality 
reviews  were  used.  Specifically,  we  wanted  to  find  out 

if  the  rigs  compile  and  maintain  historic  data  on  audit  firms’  perform¬ 
ance  and 

if  the  rigs  summarize  and  analyze  quality  review  results  for  trends  or 
patterns  of  recurring  quality  problems. 

If  the  RIGS  compiled  and  maintained  a  data  base  containing  historic  data 
for  each  audit  firm,  they  would  be  able  to  determine  the  quality  of  audit 
work  performed  by  each  audit  firm  over  a  period  of  years.  The  data 
base  could  be  used  to  answer  the  following  types  of  questions: 

How  much  experience  do  the  audit  firms  have  in  performing  financial 
and  compliance  audits  for  the  agency? 

How  many  times  have  the  firms  been  quality  control  reviewed? 

Which  firms  have  performed  satisfactory  work  in  the  past? 

Which  firms  need  more  technical  assistance  to  improve  their 
performance? 

Which  firms  have  improved  their  performance? 

Which  firms  need  to  be  monitored  more  closely? 

Which  firms  have  consistently  performed  unacceptable  audit  work? 

With  this  information,  the  rigs  could  use  their  resources  more  effec¬ 
tively.  For  example,  they  could  focus  less  attention  on  firms  that  have  a 
history  of  acceptable  work  and  more  on  firms  with  prior  unacceptable 
performance.  This  information  could  also  be  used  to  track  and  document 
unacceptable  work  when  a  rig  intends  to  take  actions  against  a  cpa. 

In  addition  to  tracking  individual  firms,  the  data  base  would  permit  the 
rigs  to  aggregate  the  results  of  their  quality  reviews  to  determine  the 
common  problems  occurring  in  the  audit  reports  and  in  the  conduct  of 
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RIGs  Do  Not  Compile, 
Summarize,  and  Analyze 
Historic  Data  on  Audit 
Firms 


the  audits  for  use  in  future  contracting  decisions.  For  example,  the  rigs 
may  find  that  their  guidance  is  inadequate  or  unclear.  On  the  other 
hand,  analyses  might  show  that  the  audit  firms  were  unfamiliar  with 
recent  changes  in  audit  requirements  or  that  the  rigs  were  not  putting 
enough  emphasis  on  certain  areas  of  the  audit  work.  Once  the  rigs  deter¬ 
mined  the  common  types  of  problems  and  their  causes,  they  could  act  to 
prevent  or  minimize  these  problems  in  the  future.  The  rigs  could  clarify 
guidance,  keep  the  audit  firms  up-to-date  with  changing  audit  require¬ 
ments,  and  emphasize  areas  that  need  more  attention. 


None  of  the  46  rigs  systematically  compiles  and  maintains  historic  data 
on  audit  firms’  performance  from  their  reviews  of  audits  contracted  for 
by  grantees.  Seven  rigs  that  contracted  directly  with  audit  firms  did 
keep  some  data  on  those  audits,  but  only  in  order  to  help  them  make 
contract  renewal  decisions.  However,  even  at  these  rigs  where  the  infor¬ 
mation  is  collected  and  used  for  contracting  purposes,  the  information 
did  not  address  quality  review  results  related  to  specific  generally 
accepted  government  auditing  standards. 

During  our  work,  we  found  that  some  audit  firms  in  our  sample  con¬ 
tracted  to  perform  audit  services  for  one  ig  in  more  than  one  1G  regional 
office,  or  for  more  than  one  RIG  in  a  particular  region.  Presently,  the  rigs 
do  not  share  information  on  the  performance  of  these  auditors.  We 
found  one  instance  where  the  rig  had  problems  with  an  audit  firm’s 
report.  This  firm  also  contracted  with  another  agency  in  the  same  region 
where  the  rig  also  noted  problems.  We  did  not  track  firms’  performance 
in  all  of  the  locations,  but  believe  that  the  rigs  should  be  aware  of  a 
firm’s  past  performance  so  that  the  rigs  could  more  closely  monitor 
these  audits. 

Several  rigs  told  us  that  they  believed  they  did  not  need  to  compile  and 
maintain  historic  data  on  audit  firms.  They  gave  the  following  reasons 
for  not  compiling  the  data: 

•  They  know  who  the  “problem”  auditors  are  without  using  a  formal 
system. 

•  They  do  not  know  what  the  legal  ramifications  would  be  if  they  were  to 
share  negative  information  about  an  audit  firm  with  other  RIG  offices. 

We  believe  rigs  should  develop  a  system  tailored  to  their  own  specific 
needs.  While  the  rigs  may  know  who  the  "problem”  auditors  are — espe¬ 
cially  in  offices  where  only  a  few  audit  firms  are  used,  we  believe  rigs 
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should  not  rely  on  their  institutional  memory  in  lieu  of  documenting 
quality  review  results  in  writing.  This  becomes  even  more  important 
when  data  are  sent  to  headquarters  to  gain  a  nationwide  perspective 
about  quality  problems. 

Last,  we  believe  there  is  precedent  for  different  agency  igs  sharing 
information  among  themselves  on  the  performance  of  audit  firms.  For 
example,  the  Southeastern  Intergovernmental  Audit  Forum  periodically 
publishes  lists  of  firms  whose  work  has  been  quality  control  reviewed 
by  a  particular  rig.  Other  rigs  may  call  to  discuss  an  audit  firm’s  per¬ 
formance  based  on  the  quality  control  review  results. 

We  believe  that  the  information  on  audit  firms  is  readily  available  in  the 
rigs’  case  files  since  most  rigs  document  the  results  of  their  reviews  on  a 
desk  review  or  quality  control  checklist.  The  rigs  should  develop  a  sys¬ 
tem  to  meet  their  needs  in  the  least  burdensome  way. 

At  the  present  time,  the  hhs  IG  is  pilot-testing  a  computer  data  base  in  its 
Phoenix  office  that  will  collect  information  on  types  of  problems  noted 
during  desk  reviews.  These  problems  will  be  coded  and  will  relate  to  the 
professional  standards  for  performing  the  audit.  This  program  is  dis¬ 
cussed  in  more  detail  in  the  next  section. 


As  we  have  noted,  much  of  the  actual  audit  quality  review  function  took 
place  in  the  regional  IG  offices.  Generally,  the  audit  quality  review  sys¬ 
tem  was  decentralized  by  headquarters  igs  to  their  regional  offices.  We 
believe  that  if  headquarters  igs  acted  as  a  focal  point  for  gathering 
regional  data  on  recurring  quality  problems,  the  usefulness  and  integrity 
of  the  system  would  improve  greatly. 

The  headquarters  igs  could  accomplish  two  major  purposes  if  they  were 
more  involved  in  monitoring  the  quality  review  system.  First,  where 
common  problems  or  patterns  of  deficiencies  arose,  headquarters  could 
take  steps  to  educate  federal  program  managers,  grantees,  and  auditors 
so  that  these  problems  would  not  recur  with  the  same  frequency.  Moni¬ 
toring  the  system  would  also  help  the  igs  remedy  any  problems  stem¬ 
ming  from  inconsistent  or  inaccurate  guidance  provided  by  them. 

Secondly,  we  believe  that  if  the  headquarters  igs  obtained,  analyzed, 
and  used  the  regions’  quality  review  results  on  a  consistent  basis,  the  igs 
could  then  periodically  inform  their  agency  heads  and  the  Congress  on 
the  results  of  the  igs’  nationwide  audit  quality  review  efforts.  We 
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believe  that  this  information  should  include  statistical  data  on  the  types 
of  audit  quality  problems  found  and  the  recourse  taken  on  substandard 
audits.  It  could  routinely  be  included  in  the  ig’s  semiannual  reports  to 
the  Congress  and  would  strengthen  the  agencies’  commitment  to  main¬ 
taining  a  high  level  of  quality  among  nonfederal  auditors. 


Current  Efforts 
Underway  to  Improve 
Audit  Quality  Review 
Systems 


Our  review  of  the  rigs’  audit  quality  review  systems  was  made  during 
the  period  October  1984  through  September  1985.  During  our  review, 
we  found  that  igs,  the  President’s  Council  on  Integrity  and  Efficiency 
(pcie),  the  Office  of  Management  and  Budget,  and  the  aicpa  have  initi¬ 
ated  efforts  to  improve  audit  quality.  We  believe  that  several  of  these 
efforts  were  undertaken,  in  part,  because  of  the  Subcommittee’s  concern 
about  audit  quality  and  its  request  for  our  review. 


Although  some  of  these  efforts  contain  draft  guidelines  and  one  is  being 
pilot-tested,  none  had  yet  been  fully  implemented  at  the  time  of  our 
review.  Therefore,  we  cannot  comment  on  the  efficacy  of  these  efforts 
except  to  say  that,  in  general,  they  are  very  constructive  and  seem  to  be 
addressing  a  number  of  our  recommendations  to  the  inspectors  general. 
These  initiatives  are  consistent  with  our  recommendations  for  collecting 
and  analyzing  results  of  desk  and  quality  control  reviews,  considering 
actions  against  cpas,  and  providing  guidance  to  cpas. 

The  following  section  describes  some  of  these  initiatives. 


The  Department  of  Health 
and  Human  Services — 
Automated  Quality  Review 
System 


The  hhs  ig  is  developing  an  automated  quality  review  system  to  stream¬ 
line  the  processing  of  nonfederal  audit  reports.  The  system,  currently 
being  pilot-tested  in  the  Phoenix  field  office,  will  collect  data  which  can 
be  used  for  the  following  purposes: 

managing  and  controlling  the  workload; 

maintaining  a  record  of  problems  with  reports  by  program,  auditee,  and 
audit  firm; 

providing  information  that  can  be  analyzed  to  determine  recurring  prob¬ 
lems  encountered  with  the  quality  of  audits; 
keeping  track  of  the  status  of  audits;  and 

providing  an  up-to-date  universe  of  entities  for  which  hhs  is  the  cogni¬ 
zant  agency. 
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Department  of  Education — 
Revisions  to  Policies  and 
Procedures  Regarding 
Substandard  Audit  Work 


The  Department  of  Education  ig  is  reviewing  its  policies  and  procedures 
for  addressing  substandard  performance  by  independent  auditors,  and 
has  proposed  new  guidelines  for  referring  cpas  to  regulatory  or  profes¬ 
sional  bodies.  Under  its  old  policy,  cpas  were  not  referred  to  the  aicpa’s 
Ethics  Division  and  state  boards  of  accountancy  if  the  auditors  cor¬ 
rected  the  deficiencies  within  a  time  frame  that  the  rig  judged  reason¬ 
able.  The  ig’s  proposed  revisions  provide  for  correcting  some 
deficiencies  without  a  referral  but,  also,  require  the  ig  to  consider  other 
factors  in  deciding  whether  to  refer  a  cpa.  These  factors  include  the 
materiality  of  the  deficiencies,  whether  the  audit  firm  adhered  to  the 
program  audit  guide,  whether  corrective  actions  are  possible  and  are 
made  as  requested,  and  whether  the  deficiency  occurred  repeatedly. 
Educations’  IG  told  us  that  the  proposed  revisions  have  been  incorpo¬ 
rated  into  its  policy  and  are  currently  in  effect. 


AICPA  Task  Force  to  Study  A  task  force  from  the  aicpa  has  been  established  to  study  the  quality  of 
the  Quality  of  Audits  audits  of  governmental  units.  The  task  force  is  working  through  the  igs 

at  the  grant-making  agencies  to  obtain  information  on  the  results  of  desk 
reviews  and  quality  control  reviews. 


PCIE  Revisions  to  “Orange  As  a  result  of  the  passage  of  the  Single  Audit  Act  of  1984.  the  pcie 

formed  a  committee  to  revise  and  update  the  “Cognizant  Audit  Agency 
Guidelines”  under  omb  Circular  A-102  (The  Orange  Book).  These  guide¬ 
lines  provide  guidance  for  cognizant  audit  agencies  in  carrying  out  their 
responsibilities  under  the  circular.  The  revision,  issued  in  October  1 985. 
incorporates  changes  and  new  provisions  brought  about  by  the  act  to 
specify  the  role  of  cognizant  agencies  to  fully  implement  the  Single 
Audit  Act.  These  revised  guidelines  address  many  of  the  objectives  for  a 
good  quality  review  system  discussed  in  this  report. 


OMB  Guidelines  for  IG 
Development  of  a  Quality 
Control  Program  for  Single 
Audits 


In  September  1985,  omb  asked  the  inspectors  general  to  supplement  the 
provisions  of  omb  Circular  A- 128,  "Audits  of  State  and  Local  Govern¬ 
ments,”  by  developing  a  quality  control  program  for  single  audits.  Some 
of  the  areas  for  consideration  were: 

desk  reviews  on  100  percent  of  the  audit  reports, 
quality  control  reviews  conducted  at  least  once  every  3  years  of  recipi¬ 
ents  for  which  an  agency  has  cognizance, 
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•  quality  control  reviews  on  a  sample  of  recipients  receiving  direct  federal 
funds  when  there  is  no  agreed  upon  cognizant  agency,  and 

•  states  responsible  for  quality  control  reviews  of  recipients  receiving  all 
of  their  federal  funds  through  the  states. 


State  and  Local  Audit  and 
Accounting  Guidance 
Incorporates  the  Single 
Audit  Concept 


The  aicpa’s  guide  for  Audits  of  State  and  Local  Governmental  Units,  last 
published  in  1975,  has  been  significantly  revised.  The  revised  guide  will 
incorporate  guidance  for  the  single  audit  concept  based  upon  the  provi¬ 
sions  of  the  Single  Audit  Act  of  1984  and  implementing  regulations  con¬ 
tained  in  omb  Circular  A- 128,  “Audits  of  State  and  Local  Governments,” 
issued  in  April  1985.  This  merging  of  guidance  will  provide  comprehen¬ 
sive  audits  of  governmental  entities.  This  guidance,  which  will  be  avail¬ 
able  to  the  audit  community  by  the  end  of  1985,  is  intended  to  assure 
the  uniform  application  of  audit  requirements. 


We  believe  the  igs  play  a  major  role  in  monitoring  audit  quality  and  in 
taking  steps  to  ensure  that  past  recurring  problems  are  corrected.  We 
found  that  the  igs,  on  the  whole,  have  identified  numerous  instances  of 
work  that  they  did  not  accept.  These  situations,  where  cpas  did  not  per¬ 
form  required  audit  work,  did  not  adequately  document  audit  work  per¬ 
formed,  or  did  not  prepare  clear  audit  documentation,  warrant  the 
concern  of  the  Congress,  the  executive  branch,  and  the  accounting  pro¬ 
fession.  These  results  also  demonstrate  a  need  for  continued  and 
improved  monitoring  by  the  inspectors  general. 

We  believe  that  the  importance  of  audit  quality  will  be  underscored  as 
the  Single  Audit  Act  approaches  full  implementation,  cpas  will  be 
involved  to  ensure  that  federal  funds  are  properly  accounted  for  and 
that  programs  are  administered  in  accordance  with  applicable  laws  and 
regulations.  It  is  appropriate  now  for  the  igs  and  the  accounting  profes¬ 
sion  to  address  those  audit  quality  problems  that  surfaced  during  prior 
CPA  audits  of  federal  programs  so  that  the  quality  problems  discussed  in 
this  report  do  not  carry  over  to  audits  performed  under  the  Single  Audit 
Act. 


Conclusions  and 
Recommendations  for 
the  Statutory 
Inspectors  General 
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Recommendations  to 
the  Statutory 
Inspectors  General 


In  order  to  provide  a  quality  control  system  that  adequately  identifies, 
disseminates,  and  corrects  audit  problems,  we  recommend  that  the  stat¬ 
utory  inspectors  general: 

Prepare  and  update  program  audit  guides  for  nonfederal  auditors  to  use 
in  the  conduct  of  their  audits.  Due  to  the  passage  of  the  Single  Audit 
Act,  all  audit  guides  should  be  reviewed  to  determine  how  they  can  best 
assist  the  auditor  in  performing  grant  audits  that  build  upon  the  single 
audit. 

Develop  and  require  regional  inspector  general  offices  to  use  standard¬ 
ized  checklists  that  are  annotated  to  gagas. 


•  Require  all  rigs  to  conduct  quality  control  reviews  on  an  established 
percentage  of  the  audit  reports  they  receive. 

•  Clarify,  and  where  necessary,  revise  policies  on  taking  actions  against 
CPAs  on  unacceptable  audits,  even  when  the  auditor  ultimately  provides 
an  acceptable  report.  Policies  should  also  include  provisions  for  refer¬ 
ring  CPAs  to  regulatory  and  professional  bodies  such  as  state  boards  of 
accountancy  and  the  aicpa,  respectively. 

•  Work  with  the  aicpa  and  appropriate  state  boards  of  accountancy  to 
expedite  referrals  to  these  bodies. 

•  Require  regional  IG  offices  to  collect,  compile,  analyze,  and  use  data  on 
the  results  of  their  quality  control  reviews  of  individual  audits  to  iden¬ 
tify  and  correct  trends  or  patterns  of  quality  problems. 

•  Require  regional  IG  offices  to  report  quality  review  results  to  headquar¬ 
ters  using  consistent  formats  and  terminology  so  that  nationwide  trends 
and  patterns  of  quality  problems  can  be  identified. 

•  Report  problems  identified  and  efforts  to  improve  audit  quality  to 
agency  heads  and  to  the  Congress  in  their  semiannual  reports. 
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Appendix  II _ 

Fifteen  Elements  of  an  Effective  IG  Audit 
Quality  Review  System 


Figure  11.1:  Securing  Audit  Services  and 
Reports 
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See  next  page 
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Appendix  □ 

Fifteen  Elements  of  an  Effective  IG  Audit 
Quality  Review  System 


1.  ig  is  involved  in  assuring  that  contracts  for  audit  are  appropriate  and 
comprehensive. 

2.  ig  assures  that  the  ig  office  receives  all  of  the  audit  reports  it  is  sup¬ 
posed  to  receive,  and  on  a  timely  basis. 

3.  Provide  accurate  and  up-to-date  guidance  for  the  auditor  to  use  in  the 
earliest  stages  of  the  audit  engagement. 

4.  Assure  that  audit  reports  are  controlled  throughout  the  complete 
audit  review  cycle. 


i 


Page  37 


GAO/  AFMD-8&-20  CPA  Audit  Quality 


Appendix  □ 

Fifteen  Elements  of  an  Effective  IG  Audit 
Quality  Review  System 


Appendix  II 

Fifteen  Elements  of  an  Effective  IG  Audit 
Quality  Review  System 


5.  Conduct  a  desk  review  program  that  assures  quality  audit  reports  and 
identifies  report  findings  for  audit  resolution. 

6.  Conduct  a  quality  control  review  program  that  assures  audits  are  per¬ 
formed  in  accordance  with  professional  standards. 

7.  Use  standardized  review  checklists,  tied  to  professional  standards,  to 
perform  desk  reviews  and  quality  control  reviews. 

8.  Communicate  with  the  auditor  and  grantee  to  correct  noted  deficien¬ 
cies,  using  procedures  established  by  the  headquarters  iGs. 

9.  Assure  that  appropriate  sanctions  are  taken  when  severe  problems 
are  noted.  This  should  include  requirements  for  documenting  action 
taken. 

10.  Compile  and  maintain  historic  data  on  audit  firms  on  both  issued 
reports  and  unacceptable  audits. 

11.  Inform  both  the  grantee  and  auditor  of  quality  review  results  on 
both  issued  reports  and  unacceptable  audits. 
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Quality  Review  System 


12.  Record  and  summarize  quality  review  results  at  the  regional  level. 

13.  Consistently  and  accurately  report  quality  review  results  to  the 
headquarters  igs. 

14.  Analyze  and  use  quality  review  results  on  a  nationwide  basis. 

15.  Report  nationwide  results  of  quality  reviews  to  the  agency  head  and 
to  the  Congress. 
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